<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: "IntelOne Text"; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend" style="color: inherit;"></div>
<div><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><b>From:</b> Gowrishankar Muthukrishnan<br>
<b>Sent:</b> Sunday, February 16, 2025 14:28<br>
<b>To:</b> dev@dpdk.org; Akhil Goyal; Ji, Kai; Fan Zhang<br>
<b>Cc:</b> anoobj@marvell.com; Gowrishankar Muthukrishnan; stable@dpdk.org<br>
<b>Subject:</b> [PATCH] crypto/openssl: validate incorrect signature in verify op
</span>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-size: 11pt;">Return correct error status when incorrect signature is<br>
used in RSA verify op.<br>
<br>
Fixes: d7bd42f6db19 ("crypto/openssl: update RSA routine with 3.0 EVP API")<br>
Cc: stable@dpdk.org<br>
<br>
Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com><br>
---<br>
drivers/crypto/openssl/rte_openssl_pmd.c | 3 +++<br>
1 file changed, 3 insertions(+)<br>
<br>
diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c<br>
index b090611bd0..239688ed47 100644<br>
--- a/drivers/crypto/openssl/rte_openssl_pmd.c<br>
+++ b/drivers/crypto/openssl/rte_openssl_pmd.c<br>
@@ -2710,6 +2710,8 @@ process_openssl_rsa_op_evp(struct rte_crypto_op *cop,<br>
return ret;<br>
}<br>
<br>
+ cop->status = RTE_CRYPTO_OP_STATUS_ERROR;<br>
+</div>
<div class="elementToProof" style="font-size: 11pt;">[Kai] I dont see any status need to be change between L.2694 to here, unless I missing anyhere. </div>
<div class="elementToProof" style="font-size: 11pt;"><br>
switch (op->rsa.op_type) {<br>
case RTE_CRYPTO_ASYM_OP_ENCRYPT:<br>
if (EVP_PKEY_encrypt_init(rsa_ctx) != 1)<br>
@@ -2807,6 +2809,7 @@ process_openssl_rsa_op_evp(struct rte_crypto_op *cop,<br>
op->rsa.sign.data,<br>
op->rsa.sign.length) <= 0) {<br>
OPENSSL_free(tmp);<br>
+ ret = 0;</div>
<div class="elementToProof" style="font-size: 11pt;">[Kai] Please add some comments why ret need to return 0<br>
goto err_rsa;<br>
}<br>
<br>
--<br>
2.25.1<br>
<br>
</div>
</body>
</html>